Nginx SSL and POODLE

Running a secure website on Nginx. So your running a website and want https? well SSL v2 is insecure, so that need disabling, we also need to disable SSLv3, as TLS 1.0 suffers from a downgrade attack, which allows an attacker to force a connection to use SSLv3 and thus disable forward security. So you need to edit your Nginx config file. Here is the configuration that I use ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # don’t use SSLv3 ref: POODLE Then tell Nginx to reload the configuration and your done. You can test your server at the following url https://www.ssllabs.com/ssltest/index.html

Details:
Admin
14.01.2015 19:19:00 Tags:
nginx ssl poodle